Machine learning models have demonstrated tremendous success in many domains including mobile image processing [1]}, targeted ad placement [2]}, and security services [3]}. The growing availability of vast datasets has aided in this recent success. Practitioners often rely upon data scraped from the web or sourced from a third party [4]}, [5]}, where the security of such data can be compromised by malicious actors. Data Poisoning attacks pose a specific threat in which an attacker modifies a victim's training data to achieve goals such as targeted misclassification or performance degradation. Basic data poisoning schemes implement backdoor triggers in training data, whereas recent works have also demonstrated that data poisoning schemes can successfully attack deep learning models trained on industrial-scale datasets [6]}, [7]} without perceptible modifications. The seriousness of these threats is acknowledged by industrial practitioners, who recently ranked poisoning as the most worrisome threat to their interests, in a recent study [8]}. Furthermore, defenses designed for older, less powerful poisoning strategies work by filtering out poisons based on feature anomalies [9]} but fail when models are trained from scratch on poisoned data [10]}, [7]}. Currently, the only method to prevent state-of-the-art targeted poisoning relies upon differentially private SGD (DP-SGD) and leads to a significant drop in validation accuracy [7]}, [13]}, [14]}.
